Describe auditing and eDiscovery solutions

Sometimes, organizational operations will require proof that they are complying with certain industry regulations or legal rulings. Or, they may have to open an investigation into actions taken by a threat actor. The auditing and eDiscovery capabilities of Microsoft 365 can be used to fulfill these types of requests.

Audit

Compliance has been defined as being able to prove policy. One of the ways you can prove actions is through logs. In the Microsoft 365 platform, nearly every conceivable action generates some form of logging event—whether it’s signing in to the service, completing an MFA challenge, connecting to a mailbox, modifying permissions to a file stored in SharePoint, adding or removing a group member, resetting an account password, or creating a transport rule in Exchange Online.

These events are collected inside the Microsoft 365 Audit log, shown in Figure 10.13:

Figure 10.13 &...